Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

1
Q

Confidentiality

A

Seeks to prevent the unauthorized disclosure of information: it keeps data secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity

A

Seeks to prevent unauthorized modification of information. In other words, seeks to prevent unauthorized write access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability

A

Ensures that information is available when needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Subject

A

An active entity on an information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Object

A

A passive data file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Annualized Loss Expectancy

A

The cost of loss due to a risk over a year.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Threat

A

A potentially negative occurrence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Vulnerability

A

A weakness in a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk

A

A matched threat and vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Safeguard

A

A measure taken to reduce risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Total Cost of Ownership

A

The cost of a safeguard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Return on Investment

A

Money saved by deploying a safeguard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Disclosure, alteration and destruction (DAD)

A

Opposite of CIA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

2 types of integrity?

A

Data integrity and system integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Data integrity

A

Seeks to prevent unauthorized modification of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

System integrity

A

Seeks to prevent unauthorized modification of a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Disclosure

A

Unauthorized release of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Alteration

A

Unauthorized modification of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Destruction

A

Making systems or data unavailable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

AAA

A

Authentication, Authorization and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Identity

A

A claim of who you are. By itself it is weak because there is no proof.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Authentication

A

Proving an identity claim.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Authorization

A

Describes the actions you can perform on a system once you have been identified and authenticated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Accountability

A

Holds users responsible for their actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Non-repudiation

A

Means a user cannot deny having performed a transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Non-repudiation

A

Combines authentication and integrity. Both of these are required before you can have this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Least privilege

A

Means users should be granted the minimum amount of access required to do their jobs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Need to know

A

More granular than least privilege: the user must need to know that specific piece of information before accessing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Examples of subjects

A

User or computer program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Examples of objects

A

Documents, database tables, text files, executable file for a computer program, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Defense-in-depth

A

Applies multiple safeguards (or controls) to protect an asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Due care

A

doing what a reasonable person would do.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Due diligence

A

The management of du care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Due care and due diligence are often confused. Think of due diligence as a step beyond due care. Due care is informal, due diligence follows a process.

A

n/a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Example of due care

A

Expecting your staff to patch their systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Example of due diligence

A

Verifying that your staff has patched their systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Gross negligence

A

Opposite of due care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Three major systems of law.

A

Civil, common, and religious.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Civil law

A

Type of law that is employed by many countries throughout the world.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Primary difference between civil law and common law

A

In civil law judicial precedents and particular case rulings do not carry the weight they do under common law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Common law

A

The legal system used in the US, Canada, UK and most former British colonies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Religious law

A

Religious doctrine or interpretation which servers as a source of legal understanding and statutes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Sharia

A

Term used for Islamic law - uses Qur’an and Hadith as its foundation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Customary law

A

Refers to those customs or practices that are so commonly accepted by a group that the custom is treated as a law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

The concept of “best practices” is closely associated with Customary law.

A

n/a

46
Q

3 branches of common law

A

Criminal, Civil and Administrative

47
Q

Criminal Law

A

Pertains to those laws where the victim can be seen as society itself. Primary focus is punishment and deterrence.

48
Q

Goal of criminal law

A

To promote and maintain an orderly and law abiding citizenry.

49
Q

Civil Law (as a branch of common law)

A

Pertains to cases where the victim is an individual, group or organization. Primary focus is compensation for the victim rather than punishment and deterrence.

50
Q

Types of financial damages

A

Statutory, Compensatory and Punitive

51
Q

Statutory damages

A

Those prescribed by law, which can be awarded to the victim even if the victim incurred no actual loss or injury.

52
Q

Compensatory damages

A

Purpose is to provide the victim with a financial award in effort to compensate for the loss or injury incurrred as a direct result of the wrongdoing.

53
Q

Punitive damages

A

Purpose is to punish an individual or organization. These damages are typically awarded to attempt to discourage a particularly egregious violation where the compensatory or statutory damages alone would not act as a deterrent.

54
Q

Administrative law (regulatory law)

A

Law enacted by government agencies.

55
Q

Examples of administrative law

A

FCC regulations, HIPAA Security mandates, FDA regulations and FAA regulations.

56
Q

Prudent man rule

A

Another name for due care.

57
Q

Types of evidence

A

Real, Direct, Circumstantial, Corroborative and Hearsay

58
Q

Real Evidence

A

Consists of tangible or physical objects.

59
Q

Examples of real evidence

A

Hard drives, DVDs, USB drives or printed business records.

60
Q

Direct Evidence

A

Testimony provided by a witness regarding what the witness actually experienced with his/her five senses.

61
Q

Circumstantial Evidence

A

Serves to establish the circumstances related to particular points or even other evidence.

62
Q

Example showing difference between direct and circumstantial evidence

A

If a witness testifies that she saw the defendant create and distribute malware this would be direct evidence. If forensics of the defendant’s computer revealed the existence of source code for malware, this would constitute circumstantial evidence.

63
Q

Corroborative Evidence

A

Provides additional support for a fact that might have been called in to question. This does not establish a particular fact on its own.

64
Q

Hearsay

A

Second-hand evidence. Generally considered inadmissible in court.

65
Q

Business and computer generated records are generally considered hearsay evidence, but case law and updates to the Federal rules of evidence have established exceptions to this.

A

n/a

66
Q

Five desirable criteria for evidence.

A

Relevant, authentic, accurate, complete and convincing

67
Q

Best evidence rule

A

courts prefer the best evidence possible - original documents preferred over copies, conclusive tangible objects preferred over oral testimony. Recall the five desirable criteria for evidence.

68
Q

Secondary evidence

A

Class of evidence common in cases involving computers. Consists of copies of original documents and oral descriptions.

69
Q

Rule 1001 of the US Federal Rules of Evidence

A

Can allow for readable reports of data contained on a computer to be considered original as opposed to secondary evidence.

70
Q

Fourth amendment

A

Protects citizens from unreasonable search and seizure by the government.

71
Q

Exception to requirement for search warrant in computer crimes.

A

Exigent circumstances in which there is an immediate threat to human life or evidence being destroyed.

72
Q

Search warrants only apply to law enforcement and those who are acting under the color of law enforcement.

A

n/a

73
Q

If private citizens carry out actions or investigations on behalf of law enforcement these individuals are acting under the color of law and can be considered agents of law enforcement.

A

n/a

74
Q

Entrapment

A

When law enforcement, or an agent of law enforcement, persuades someone to commit a crime when the person otherwise had no intention to commit a crime.

75
Q

Enticement

A

Differs from entrapment in that the person is determined to have already broken a law or is intent on doing so.

76
Q

3 categories for computer crimes

A

Computer systems as targets
Computer systems as a tool to perpetrate the crime
Computer systems involved but incidental

77
Q

Intellectual property

A

Refers to intangible property that resulted from a creative act.

78
Q

Trademarks (TM or ®)

A

Purpose is to allow for the creation of a brand that distinguishes the source of products or services.

79
Q

Servicemarks (SM)

A

Constitute a subset of brand recognition related intellectual property.

80
Q

Patents

A

Provide a monopoly to the holder on the right to use, make, or sell an invention for a period of time in exchange for the holder’s making the invention public.

81
Q

Typical length of a patent in US and Europe?

A

20 years

82
Q

Copyright (©)

A

Represents a type of intellectual property that protects the form of expression in artistic, musical, or literary works.

83
Q

Typical length of a copyright in US

A

70 years after the death of the author.
If the work is a product of a corporation then the term lasts for 95 years after the first publication or 120 years after creation, whichever comes first.

84
Q

First sale doctrine

A

Allows a legitimate purchaser of a copyrighted material to sell it to another person.

85
Q

Fair use doctrine

A

Allows someone to duplicate copyrighted material without requiring the payment, consent, or even knowledge of the copyright holder.

86
Q

Software licenses

A

Agreement between provider of software and the consumer.

87
Q

Trade secrets

A

Business-proprietary information that is important to an organization’s ability to compete.

88
Q

Well known intellectual property attacks

A

Software piracy and copyright infringement.

89
Q

Trademark dilution

A

Represents an unintentional attack in which the trademarked brand name is used to refer to the larger general class of products of which the brand is a specific instance. Example: Using Kleenex to refer to all facial tissue regardless of brand

90
Q

Cybersquatting

A

Refers to an individual or organization registering or using, in bad faith, a domain name that is associated with another person’s trademark.

91
Q

Typosquatting

A

Refers to a specific type of cybersquatting in which the cybersquatter registers likely misspellings or mistyping of legitimate domain trademarks.

92
Q

Privacy

A

The protection of the confidentiality of personal information.

93
Q

EU Data Protection Directive

A

Allows for the free flow of information while still maintaining consistent protections of each member nation’s citizens’ data.

94
Q

Principles of EU Data Protection Directive

A
  • Notifying individuals how their personal data is collected and used.
  • Allowing individuals to opt out of sharing their personal data with third parties.
  • Requiring individuals to opt into sharing the most sensitive personal data.
  • Providing reasonable protections for personal data.
95
Q

Organization for Economic Cooperation and Development (OECD)

A
  • Though often considered excusively European, consists of 30 member nations from around the world.
  • Provides a forum in which countries can focus on issues that impact the global economy.
96
Q

OECD Guidelines on the protection of Privacy and Transborder Flows of Personal Data

A

Issues in 1980, sought to provide a basic framework for the protections that should be afforded personal data as it traverses the various world economies.

97
Q

Eight driving principles regarding the privacy of personal data.

A
  • Collection Limitation Principle
  • Data Quality Principle
  • Purpose Specification Principle
  • Use Limitation Principle
  • Security Safeguards Principle
  • Openness Principle
  • Individual Participation Principle
  • Accountability Principle
98
Q

Collection Limitation Principle

A

Personal data collection should have limits, be obtained in a lawful manner, and, unless there is a compelling reason to the contrary, with the individual’s knowledge and approval.

99
Q

Data Quality Principle

A

Personal data should be complete, accurate, and maintained in a fashion consistent with the purposes for the data collection.

100
Q

Purpose Specification Principle

A

The purpose for the data collection should be known, and the subsequent use of the data should be limited to the purposes outlined at the time of collection.

101
Q

Use Limitation Principle

A

Personal data should never be disclosed without either the consent of the individual or as the result of a legal requirement.

102
Q

Security Safeguards Principle

A

Personal data should be reasonably protected against unauthorized use, disclosure, or alteration.

103
Q

Openness Principle

A

The general policy concerning collection and use of personal data should be readily available.

104
Q

Individual Participation Principle

A

Individuals should be:

  • Able to find out if an entity holds any of their personal data.
  • Made aware of any personal data being held.
  • Given a reason for any denials to account for personal data being held, and a process for challenging any denials
  • Able to challenge the content of any personal data being held, and have a process for updating their personal data if found to be inaccurate or incomplete.
105
Q

Accountability Principle

A

The entity using the personal data should be accountable for adhering to the principles above.

106
Q

EU Data Protection Directive states that personal data of EU citizens may not be transmitted, even when permitted by the individual, to countries outside of the EU unless the receiving country is perceived by the EU to adequately protect their data.

A

EU-US Safe Harbor was created because of this, to account for the US having less stringent privacy protections.

107
Q

EU-US Safe Harbor

A

Framework that will give US based organizations the benefit of authorized data sharing with the EU.

108
Q

Privacy Act of 1974

A

Created to codify protection of US citizens’ data that is being used by the federal government.

109
Q

Council of Europe Convention on Cybercrime

A

Most significant progress toward international cooperation in computer crime policy. Focused on establishing standards in cybercrime policy to promote international cooperation during the investigation and prosecution of cybercrime. Signed by the 47 European members as well as US.

110
Q

Coordinating Committee for Multilateral Export Controls (CoCom)

A

During the Cold War, this was a multinational agreement to not export certain technologies, which included encryption, to many communist countries.

111
Q

Wassenaar Agreement

A

Post Cold War standard for export controls. Still included significant restrictions on the export of cryptographic algorithms and technologies to countries not included in the agreement.

CISSP (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions